1<?php 2/* Copyright (C) 2010-2021 Regis Houssin <regis.houssin@inodbox.com> 3 * Copyright (C) 2017 Laurent Destailleur <eldy@users.sourceforge.net> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation; either version 3 of the License, or 8 * (at your option) any later version. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <https://www.gnu.org/licenses/>. 17 */ 18 19/** 20 * \file htdocs/core/ajax/row.php 21 * \brief File to return Ajax response on Row move. 22 * This ajax page is called when doing an up or down drag and drop. 23 * Parameters: 24 * roworder (Example: '1,3,2,4'), 25 * table_element_line (Example: 'commandedet') 26 * fk_element (Example: 'fk_order') 27 * element_id (Example: 1) 28 */ 29 30if (!defined('NOTOKENRENEWAL')) { 31 define('NOTOKENRENEWAL', '1'); // Disable token renewal 32} 33if (!defined('NOREQUIREMENU')) { 34 define('NOREQUIREMENU', '1'); 35} 36if (!defined('NOREQUIREHTML')) { 37 define('NOREQUIREHTML', '1'); 38} 39if (!defined('NOREQUIREAJAX')) { 40 define('NOREQUIREAJAX', '1'); 41} 42if (!defined('NOREQUIRESOC')) { 43 define('NOREQUIRESOC', '1'); 44} 45if (!defined('NOREQUIRETRAN')) { 46 define('NOREQUIRETRAN', '1'); 47} 48 49require '../../main.inc.php'; 50require_once DOL_DOCUMENT_ROOT.'/core/class/genericobject.class.php'; 51 52// Security check 53// This is done later into view. 54 55 56/* 57 * View 58 */ 59 60top_httphead(); 61 62print '<!-- Ajax page called with url '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n"; 63 64// Registering the location of boxes 65if (GETPOST('roworder', 'alpha', 3) && GETPOST('table_element_line', 'aZ09', 3) 66 && GETPOST('fk_element', 'aZ09', 3) && GETPOST('element_id', 'int', 3)) { 67 $roworder = GETPOST('roworder', 'alpha', 3); 68 $table_element_line = GETPOST('table_element_line', 'aZ09', 3); 69 $fk_element = GETPOST('fk_element', 'aZ09', 3); 70 $element_id = GETPOST('element_id', 'int', 3); 71 72 dol_syslog("AjaxRow roworder=".$roworder." table_element_line=".$table_element_line." fk_element=".$fk_element." element_id=".$element_id, LOG_DEBUG); 73 74 // Make test on permission 75 $perm = 0; 76 if ($table_element_line == 'propaldet' && $user->rights->propal->creer) { 77 $perm = 1; 78 } elseif ($table_element_line == 'commandedet' && $user->rights->commande->creer) { 79 $perm = 1; 80 } elseif ($table_element_line == 'facturedet' && $user->rights->facture->creer) { 81 $perm = 1; 82 } elseif ($table_element_line == 'facturedet_rec' && $user->rights->facture->creer) { 83 $perm = 1; 84 } elseif ($table_element_line == 'ecm_files' && $user->rights->ecm->creer) { 85 $perm = 1; 86 } elseif ($table_element_line == 'emailcollector_emailcollectoraction' && $user->admin) { 87 $perm = 1; 88 } elseif ($table_element_line == 'bom_bomline' && $user->rights->bom->write) { 89 $perm = 1; 90 } elseif ($table_element_line == 'mrp_production' && $user->rights->mrp->write) { 91 $perm = 1; 92 } elseif ($table_element_line == 'supplier_proposaldet' && $user->rights->supplier_proposal->creer) { 93 $perm = 1; 94 } elseif ($table_element_line == 'commande_fournisseurdet' && $user->rights->fournisseur->commande->creer) { 95 $perm = 1; 96 } elseif ($table_element_line == 'facture_fourn_det' && $user->rights->fournisseur->facture->creer) { 97 $perm = 1; 98 } elseif ($table_element_line == 'ecm_files' && $fk_element == 'fk_product' && (!empty($user->rights->produit->creer) || !empty($user->rights->service->creer))) { 99 $perm = 1; 100 } elseif ($table_element_line == 'ecm_files' && $fk_element == 'fk_ticket' && !empty($user->rights->ticket->write)) { 101 $perm = 1; 102 } elseif ($table_element_line == 'projet_task' && $fk_element == 'fk_projet' && $user->rights->projet->creer) { 103 $perm = 1; 104 } else { 105 $tmparray = explode('_', $table_element_line); 106 $tmpmodule = $tmparray[0]; $tmpobject = preg_replace('/line$/', '', $tmparray[1]); 107 if (!empty($tmpmodule) && !empty($tmpobject) && !empty($conf->$tmpmodule->enabled) && !empty($user->rights->$tmpobject->write)) { 108 $perm = 1; 109 } 110 } 111 112 if (! $perm) { 113 // We should not be here. If we are not allowed to reorder rows, feature should not be visible on script. 114 // If we are here, it is a hack attempt, so we report a warning. 115 print 'Bad permission to modify position of lines for object in table '.$table_element_line; 116 dol_syslog('Bad permission to modify position of lines for object in table='.$table_element_line.', fk_element='.$fk_element, LOG_WARNING); 117 accessforbidden('Bad permission to modify position of lines for object in table '.$table_element_line); 118 } 119 120 $rowordertab = explode(',', $roworder); 121 $newrowordertab = array(); 122 foreach ($rowordertab as $value) { 123 if (!empty($value)) { 124 $newrowordertab[] = $value; 125 } 126 } 127 128 $row = new GenericObject($db); 129 $row->table_element_line = $table_element_line; 130 $row->fk_element = $fk_element; 131 $row->id = $element_id; 132 133 $row->line_ajaxorder($newrowordertab); // This update field rank or position in table row->table_element_line 134 135 // Reorder line to have position of children lines sharing same counter than parent lines 136 // This should be useless because there is no need to have children sharing same counter than parent, but well, it's cleaner into database. 137 if (in_array($fk_element, array('fk_facture', 'fk_propal', 'fk_commande'))) { 138 $result = $row->line_order(true); 139 } 140} else { 141 print 'Bad parameters for row.php'; 142} 143